Front and the GDPR: AI training, data location and DPA

Trains on your data unless you switch it off.

Yes, in a limited way, while an admin has AI Features switched on: Front may use that data to improve its services and AI instructions (pricing FAQ: 'further train your model', kept per company). Its AI providers are barred from training foundation models on it

Vendor's wording: “we may use the data you share with us (like text or other content) through AI Features to improve the services we provide to you as well.”

Source: help.front.comFAQ > How does AI Features use my data?Checked on 19 October 2026

You can switch the training off.

An admin turns off 'AI Features' in Settings; this stops new data from being processed through the AI features and removes access to them

Vendor's wording: “you can turn off the AI Features in your settings at any time.”

Source: help.front.comFAQ > How do I enable or disable Front's AI FeaturesChecked on 19 October 2026

Amazon Web Services, in the United States or the EU depending on the Service Region chosen for the account; the default is not stated

Vendor's wording: “If you choose the United States Service Region the subprocessor location is primarily the United States”

Source: front.comThird Party Subprocessors > footnote 1Checked on 19 October 2026

EU hosting available.

Yes: an EU Service Region can be chosen for the account (security page, listed under 'Enterprise features'); whether Professional includes it is not stated

Vendor's wording: “We support data hosting options in the U.S. or the EU.”

Source: front.comEnterprise features > Regional Data HostingChecked on 19 October 2026

DPA on request.

Yes: a public DPA supplements and forms part of the SaaS Agreement with FrontApp, Inc. and includes EU Standard Contractual Clauses

Vendor's wording: “supplements and forms part of the Software-as-a-Service Agreement between FrontApp, Inc.”

Source: front.comDPA, introductionChecked on 19 October 2026

Published.

Yes, public at https://front.com/legal/list-of-subprocessors (effective 13 Jul 2026): 18 rows (15 third parties, 3 Front group entities). AI providers: OpenAI, Azure/Microsoft, Amazon AWS, Google, Anthropic (customer support)

Vendor's wording: “A subprocessor is a third-party entity engaged by Front to perform services”

Source: front.comFront SubprocessorsChecked on 19 October 2026

On the list.

Active (FrontApp, Inc; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'FrontApp'Checked on 19 October 2026

AI providers keep nothing after each request. After the contract ends Front returns or deletes customer personal data per customer instructions (legal-hold exceptions); deletion requests are generally processed within 30 days; backups kept 7 days

Vendor's wording: “Upon expiration or earlier termination of the Agreement, Front shall return and/or delete all Customer Personal Data”

Source: front.comDPA > Deletion or return of Customer Personal DataChecked on 19 October 2026

SOC 2 Type II and ISO 27001 (2 certifications; reports available on request)

Vendor's wording: “We’re proud to be SOC 2 Type II and ISO 27001 certified, ensuring that client data is processed in a secure manner.”

Source: front.comCompliance readyChecked on 19 October 2026

Yes: a company administrator toggles 'AI Features' on or off in Settings for the organisation

Vendor's wording: “To enable Front’s AI Features, your company administrator can go to Settings and toggle on “AI Features.””

Source: help.front.comFAQ > How do I enable or disable Front's AI FeaturesChecked on 19 October 2026